Ring arithmetic method, system, and apparatus
Download PDFInfo
 Publication number
 US20030044004A1 US20030044004A1 US10068294 US6829402A US2003044004A1 US 20030044004 A1 US20030044004 A1 US 20030044004A1 US 10068294 US10068294 US 10068294 US 6829402 A US6829402 A US 6829402A US 2003044004 A1 US2003044004 A1 US 2003044004A1
 Authority
 US
 Grant status
 Application
 Patent type
 Prior art keywords
 mod
 modulus
 method
 key
 means
 Prior art date
 Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
 Granted
Links
Images
Classifications

 G—PHYSICS
 G06—COMPUTING; CALCULATING; COUNTING
 G06F—ELECTRICAL DIGITAL DATA PROCESSING
 G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
 G06F7/60—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
 G06F7/72—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic

 G—PHYSICS
 G06—COMPUTING; CALCULATING; COUNTING
 G06F—ELECTRICAL DIGITAL DATA PROCESSING
 G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
 G06F13/14—Handling requests for interconnection or transfer
 G06F13/16—Handling requests for interconnection or transfer for access to memory bus
 G06F13/1605—Handling requests for interconnection or transfer for access to memory bus based on arbitration
 G06F13/1647—Handling requests for interconnection or transfer for access to memory bus based on arbitration with interleaved bank access

 G—PHYSICS
 G06—COMPUTING; CALCULATING; COUNTING
 G06F—ELECTRICAL DIGITAL DATA PROCESSING
 G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
 G06F7/60—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
 G06F7/72—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
 G06F7/723—Modular exponentiation

 G—PHYSICS
 G11—INFORMATION STORAGE
 G11C—STATIC STORES
 G11C7/00—Arrangements for writing information into, or reading information out from, a digital store
 G11C7/10—Input/output (I/O) data interface arrangements, e.g. I/O data control circuits, I/O data buffers
 G11C7/1051—Data output circuits, e.g. readout amplifiers, data output buffers, data output registers, data output level conversion circuits
 G11C7/1066—Output synchronization

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L47/00—Traffic regulation in packet switching networks
 H04L47/10—Flow control or congestion control
 H04L47/12—Congestion avoidance or recovery
 H04L47/125—Load balancing, e.g. traffic engineering

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L63/00—Network architectures or network communication protocols for network security
 H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
 H04L63/0272—Virtual private networks

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L63/00—Network architectures or network communication protocols for network security
 H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
 H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L63/00—Network architectures or network communication protocols for network security
 H04L63/16—Implementing security features at a particular protocol layer
 H04L63/166—Implementing security features at a particular protocol layer at the transport layer

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
 H04L9/3006—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or publickey parameters
 H04L9/302—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or publickey parameters involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes

 G—PHYSICS
 G01—MEASURING; TESTING
 G01N—INVESTIGATING OR ANALYSING MATERIALS BY DETERMINING THEIR CHEMICAL OR PHYSICAL PROPERTIES
 G01N35/00—Automatic analysis not limited to methods or materials provided for in any single one of groups G01N1/00  G01N33/00; Handling materials therefor
 G01N2035/00178—Special arrangements of analysers
 G01N2035/00237—Handling microquantities of analyte, e.g. microvalves, capillary networks
 G01N2035/00247—Microvalves

 G—PHYSICS
 G01—MEASURING; TESTING
 G01N—INVESTIGATING OR ANALYSING MATERIALS BY DETERMINING THEIR CHEMICAL OR PHYSICAL PROPERTIES
 G01N35/00—Automatic analysis not limited to methods or materials provided for in any single one of groups G01N1/00  G01N33/00; Handling materials therefor
 G01N2035/00465—Separating and mixing arrangements
 G01N2035/00564—Handling or washing solid phase elements, e.g. beads
 G01N2035/00574—Means for distributing beads

 G—PHYSICS
 G06—COMPUTING; CALCULATING; COUNTING
 G06F—ELECTRICAL DIGITAL DATA PROCESSING
 G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
 G06F7/60—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
 G06F7/72—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
 G06F7/727—Modulo N arithmetic, with N being either (2**n)1,2**n or (2**n)+1, e.g. mod 3, mod 4 or mod 5

 G—PHYSICS
 G06—COMPUTING; CALCULATING; COUNTING
 G06F—ELECTRICAL DIGITAL DATA PROCESSING
 G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
 G06F7/60—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
 G06F7/72—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
 G06F7/728—Methods or arrangements for performing computations using a digital nondenominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and nondenominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic using Montgomery reduction
Abstract
Description
 [0001]This application claims the benefit of the following U.S. Provisional Applications, all of which are hereby incorporated by reference, and the content of which are not necessarily identical to the content of this application:
COMMONLY OWNED AND PREVIOUSLY FILED U.S. PROVISIONAL PATENT APPLICATIONS Atty. Dkt. # Ser. No. Title Filing Date 501143.000005 60/288,015 Method and Apparatus for Shotgun May 2, 2001 Multiplication and Exponentiation 501143.000010 60/300,957 Method and Residue Calculation Using Jun. 26, 2001 Casting Out 501143.000011 60/300,955 AddDrop Layer 3 Ethernet Ring Switch Jun. 26, 2001 501431.000014 60/326,266 Application Specific Information Processing Oct. 1, 2001 System 501143.000015 60/326,252 Efficient Use of DRAMBased Devices For Oct. 1, 2001 Small Discontiguous Memory Accesses 501143.000016 60/326,251 Exponentiation Engine Oct. 1, 2001 501143.000017 60/326,250 Method for Squaring Oct. 1, 2001  [0002]The current application shares some specification and figures with the following commonly owned and concurrently filed applications, all of which are hereby incorporated by reference:
COMMONLY OWNED AND CONCURRENTLY FILED U.S. NONPROVISIONAL PATENT APPLICATIONS Atty. Dkt. # Ser. No. Title Filing Date 501143.000019 Not Assigned ApplicationSpecific InformationProcessing Not Assigned Method, System, and Apparatus  [0003]The benefit of 35 U.S.C. § 120 is claimed for all of the above referenced commonly owned applications. The contents of the applications referenced in the tables above are not necessarily identical to the contents of this application. The applications referenced in the tables above are referred to herein as the “Related Applications.”
 [0004]All references cited hereafter are incorporated by reference to the maximum extent allowable by law. To the extent a reference may not be fully incorporated herein, it is incorporated by reference for background purposes and indicative of the knowledge of one of ordinary skill in the art.
 [0005]1. Field of the Invention
 [0006]The present invention relates generally to ring arithmetic operations and particularly to efficient modular exponentiation of large numbers.
 [0007]2. Description of Related Art
 [0008]Modem society has seen information transmission dramatically grow in prevalence, and the importance of information security has likewise grown. Transmitting information over an open network—such as the Internet—involves many security challenges.
 [0009]The most common Internet protocol for transmitting secured information is Transport Layer Security (TLS), descendent of Secure Sockets Layer (SSL). For clarity and because of the protocols' similarities, reference will be made to SSL/TLS throughout this application. To improve speed, SSL/TLS uses symmetric encryption to encrypt much of the transmitted data. But symmetric encryption is vulnerable because communicants must share a private key.
 [0010]For improved security, SSL/TLS uses the slower asymmetric encryption to share symmetric keys. But every session requires sharing of a new private key because key reuse would substantially increase vulnerability. So in practice new sessions are established frequently, forcing heavy usage of asymmetric encryption.
 [0011]Some of the principal Internet transactions using this type of security are ecommerce transactions. In a transaction of this type, the consumer transmits identifying information as well as creditcard or other financially sensitive data to a vendor. The amount of data that must be encrypted to complete the transaction is very small, typically less than twenty lines of text. The time spent by a server encrypting this data is insignificant compared with the time necessary to encrypt and decrypt the symmetric key in the asymmetric keyexchange portion of the transaction. Because each session requires a new key, which must be encrypted and then decrypted using the slow asymmetric encryption process, whenever a significant number of sessions are established, the majority of server resources may be dedicated to the key exchange protocol.
 [0012]A preferred embodiment is a data encryption method performed with ring arithmetic operations using a residue number multiplication process wherein a first conversion to a first basis is done using a mixed radix system and a second conversion to a second basis is done using a mixed radix system. In some embodiments, a modulus C is be chosen of the form 2^{w}−L, wherein C is a wbit number and L is a low Hamming weight odd integer less than 2^{(w−1)/2}. And in some of those embodiments, the residue mod C is calculated via several steps. P is split into 2 wbit words H_{1 }and L_{1}. S_{1 }is calculated as equal to L_{1}+(H_{1}2^{x1})+(H_{1}2^{xk})+ . . . +(H_{1}2^{x1})+H_{1}. S_{1 }is split into two wbit words H_{2 }and L_{2}. S_{2 }is computed as being equal to L_{2}+(H_{2}2^{x1})+(H_{2}2^{x2})+ . . . +(H_{2}2^{xk})+H_{2}. S_{3 }is computed as being equal to S_{2}+(2^{x1}+ . . . +2^{xk}+1). And the residue is determined by comparing S_{3 }to 2^{w}. If S_{3}<2^{w}, then the residue equals S_{2}. If S_{3}>2^{w}, then the residue equals S_{3}−2^{w}.
 [0013]Further features and advantages of the invention will become apparent from the following detailed description and accompanying drawings.
 [0014]The following drawings form part of the present specification and are included to further demonstrate certain aspects of the present invention. The figures are not necessarily drawn to scale. The invention may be better understood by reference to one or more of these drawings in combination with the detailed description of specific embodiments presented herein.
 [0015][0015]FIGS. 1A and 1B show a flowchart of a shotgun multiplication process, in accordance with an embodiment of the present invention.
 [0016][0016]FIG. 2 shows a flowchart of a sliding window sary exponentiation, in accordance with an embodiment of the present invention.
 [0017][0017]FIG. 3 shows a flowchart of an exponentiation mod pq using Chinese Remainder Theorem, in accordance with an embodiment of the present invention.
 [0018][0018]FIG. 4 shows a flowchart of a castout process, in accordance with an embodiment of the present invention.
 [0019]Rivest Shamir Adleman (RSA) is one of the most common types of public key cryptography and is used for key exchanges in SSL/TLS. RSA bases its security claims on the difficulty of factoring large numbers. The public and private keys are functions of a pair of large prime numbers. Cryptanalyzing the encrypted message using only the public key could be of comparable difficulty to factoring the product of two large primes.
 [0020]The two large prime numbers p and q are used to generate the members of a key pair. The product is computed: N=pq. An encryption key e is chosen such that e and (p−1)(q−1) are relatively prime. The decryption key d=e^{−1 }(mod (p−1)(q−1)) is computed from e using the extended Euclidean algorithm. For a plaintext message S, a ciphertext message A is created by computing A=S^{e }mod N. Then computing S=A^{d }mod N decrypts ciphertext A, giving plaintext S.
 [0021]The Residue Number System (RNS) can be used to improve efficiency. Given a list of pairwise relatively prime moduli m_{1}, m_{2}, . . . m_{k}, called an RNS basis, the RNS representation of a number X with respect to this RNS basis is the ktuple (x_{1}, x_{2}, . . . x_{k}) where x_{i}=X mod m_{i}. The importance of the residue number system to numerical processes is that the operations of addition, subtraction, and multiplication modulo M (where M is the product of the moduli) can be performed without the use of carry operations between the moduli. In other words, each coordinate in the ktuple can be operated on independently and in parallel.
 [0022]The Chinese Remainder Theorem (CRT) of elementary number theory states that given an RNS basis there is a onetoone correspondence between the RNS ktuples and the residues modulo M, where M is the product of the moduli of the basis.
 [0023]CRT may be stated as follows. For a given list of positive integers m_{1}, m_{2}, . . . m_{k }such that the greatest common divisor (gcd) of any pair m_{i}, m_{j}(i≠j) is 1, then for any list of nonnegative integers r_{1}, r_{2}, . . . r_{k }such that r_{i}<m_{i}(i=1, k), there exists a unique integer X such that X (mod m_{i})=r_{i}(i=1, k) and X<m_{1 }m_{2 }. . . m_{k}, and conversely, each such X determines a unique such list of r_{i}.
 [0024]In RSA decryption it is necessary to calculate S=A^{d }mod N. Now, N=pq and gcd (p,q)=1 since p and q are both prime. So CRT uniquely determines S mod N by the pair (S mod p, S mod q).
$\begin{array}{cc}S\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89ep=\text{\hspace{1em}}\ue89e\left({A}^{d\ue89e\text{\hspace{1em}}}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89eN\right)\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep& \text{\hspace{1em}}\\ =\text{\hspace{1em}}\ue89e{A}^{d}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep& \text{\hspace{1em}}\ue89e\mathrm{Since}\ue89e\text{\hspace{1em}}\ue89eN\ue89e\text{\hspace{1em}}\ue89e\mathrm{is}\ue89e\text{\hspace{1em}}\ue89e\mathrm{multiple}\ue89e\text{\hspace{1em}}\ue89e\mathrm{of}\ue89e\text{\hspace{1em}}\ue89ep\\ =\text{\hspace{1em}}\ue89e{A}^{d}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep& \text{\hspace{1em}}\ue89e\mathrm{where}\ue89e\text{\hspace{1em}}\ue89ea=A\ue89e\text{\hspace{1em}}\ue89e\mathrm{mod}\ue89e\text{\hspace{1em}}\ue89ep\\ =\text{\hspace{1em}}\ue89e{a}^{u\ue8a0\left(p1\right)+v}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep& \text{\hspace{1em}}\ue89e\mathrm{for}\ue89e\text{\hspace{1em}}\ue89e\mathrm{some}\ue89e\text{\hspace{1em}}\ue89e\mathrm{integer}\ue89e\text{\hspace{1em}}\ue89eu,\mathrm{and}\\ \text{\hspace{1em}}& \text{\hspace{1em}}\ue89e\mathrm{for}\ue89e\text{\hspace{1em}}\ue89ev=d\ue89e\text{\hspace{1em}}\ue89e\mathrm{mod}\ue89e\text{\hspace{1em}}\ue89e\left(p1\right)\\ =\text{\hspace{1em}}\ue89e\left({a}^{u\ue8a0\left(p1\right)}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89ep\right)\ue89e\left({a}^{v}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep\right)\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep& \text{\hspace{1em}}\\ =\text{\hspace{1em}}\ue89e\left({\left({a}^{\left(p1\right)}\right)}^{u}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep\right)\ue89e\left({a}^{v}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep\right)\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep& \text{\hspace{1em}}\\ =\text{\hspace{1em}}\ue89e\left({\left(1\right)}^{u}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89ep\right)\ue89e\left({a}^{v}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep\right)\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep& \text{\hspace{1em}}\ue89e\mathrm{by}\ue89e\text{\hspace{1em}}\ue89e\mathrm{Euler}\u2019\ue89es\ue89e\text{\hspace{1em}}\ue89e\mathrm{theorem}\\ =\text{\hspace{1em}}\ue89e{a}^{v}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep& \text{\hspace{1em}}\end{array}$  [0025]Similarly, S mod q=b^{h }mod q, where b=A mod q, and h=d mod (q−1). Consider the value U=((sp −sq) g mod p) q+sq where sq=S mod p, sq=S mod q, and g is such that g q=1 mod p. U≦(p−1)q+q−1<pq=N. Also U mod q=sq=S mod q and
$\begin{array}{c}U\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89ep=\left(\left(\left(\mathrm{sp}\mathrm{sq}\right)\ue89eg\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep\right)\ue89eq+\mathrm{sq}\right)\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep\\ =\left(\left(\mathrm{sp}\mathrm{sq}\right)\ue89e\mathrm{gq}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89ep+\mathrm{sq}\right)\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89ep\\ =\left(\left(\mathrm{sp}\mathrm{sq}\right)\ue89e1\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89ep+\mathrm{sq}\right)\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep\\ =\mathrm{sp}\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89ep\\ =S\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89ep\end{array}\hspace{1em}$  [0026]So by the CRT, U=S mod N. Hence, in order to calculate S=A^{d }mod N
 [0027]1) Compute:
 [0028]a) sp=(A mod p)^{d mod(P−} 1)mod p
 [0029]b) sq=(A mod q)^{d mod (q−} 1)mod q
 [0030]2)Find g with 0<g<p and gq=1 mod p
 [0031]3) Compute S=((sp−sq) g mod p) q+sq
 [0032]Thus the problem of calculating S=A^{d }mod N where A, d and N are 2n bit numbers, is reduced to one of calculating two values sp and sq which are n bit numbers. This represents a considerable saving in computation time.
 [0033]The Mixed Radix System (MRS) expression of a given integer X modulo M (as above) is
 X=x# _{1} +x# _{2 } m _{1} +x# _{3} m _{1 } M _{2 +} x# _{k} m _{1} m _{2 } . . . m _{k−1 }0<x#_{i<} m _{i }
 [0034]The x#_{i }in the above are called the MRS digits of X. They are unique and can be calculated from the RNS residues x_{1}, x_{2 }. . . x_{k}(x_{i}=X mod m_{i}) by the following recursion:
 x# _{1} =x _{1}
 x# _{2}=(x _{2} −x# _{i})m_{1} ^{−} mod m _{2}
 x# _{3}=((X _{3} −x# _{1})m _{1} ^{−1} −X# _{2})m _{2}−^{1 }mod m_{3}
 x#_{j}=( . . . ((x _{j} −x# _{1})m _{1} ^{−1} −x# _{2})m _{2} ^{−1 } − . . . −x# _{j1})m _{j1} ^{1} mod m _{j }
 [0035]The Montgomery Modular Multiplication (MMM) facilitates repetitive modular reduction operations, mod N, where N is an odd integer constant. Public key cryptography depends heavily on arithmetic operations modulo a multipleprecision odd integer. So the performance of a public key cryptosystem depends heavily on the speed with which it executes those operations. Multiplications and divisions have particularly large influences on processing time. The Montgomery method particularly facilitates repeatedly executing multiplications. The Montgomery method is a method for computing multipleprecision modular multiplication with a processing cost of about two multipleprecision multiplications. Multipleprecision modular reduction usually has a poor performance compared with multipleprecision multiplication, so the Montgomery method can significantly improve performance.
 [0036]Suppose two numbers are to be multiplied. First, they are each transformed into Montgomery space by taking mod p of each. Then the Montgomery multiplication is carried out, and its result is inversely transformed out of Montgomery space. The transformation and inverse transformation each have a processing load of about one multipleprecision multiplication. Consequently, modular exponentiation suffers lower overhead due to the Montgomery conversion and the inverse Montgomery conversion because it carries out modular multiplications repeatedly and therefore it can be realized by a fast implementation. The Montgomery method can benefit many public key algorithms, including RSA, that use modular exponentiation, S=A^{d }mod N, as their basic operation. But the Montgomery method will not necessarily lead to efficient implementation if only some multiplications are required due to transform and inverse transform overhead.
 [0037]Various MMM methods are known. See, for example, Peter L. Montgomery, “Modular Multiplication Without Trial Division”, Mathematics of Computations, vol. 44, no. 170, pp. 519521, Apr. 1985; Stephen R. Dussé and Burton S. Kaliski, Jr., “A Cryptographic Library for the Motorola DSP 56000”, Advances in Cryptography, Proc Eurocrypt'90, Lecture Notes In Computer Science no. 473, pp. 230244, SpringerVerlag, 1990; and the methods of U.S. Pat. No. 4,514,592 to Miyaguchi, U.S. Pat. No. 5,101,431, to Even, U.S. Pat. No. 5,321,752 to Iwamura, U.S. Pat. No. 5,448,639, to Arazi, and U.S. Pat. No. 5,513,133 to Gressel.
 [0038]SHOTGUN MULTIPLICATION
 [0039][0039]FIGS. 1A and 1B depict a shotgun multiplication process. The processing occurs in parallel mathematically independent units. In a precomputation phase 12 m_{i}, M, and W are defined 14. The m_{i }are kbit moduli (m_{1}, m_{2}, . . . m_{2t}), where the moduli m_{i }are pairwise mutually prime and t ≧(n+1)/k, where n is the bit length of the numbers being multiplied. M is defined as the product of the first t moduli: M=m_{1}m_{2 }. . . m_{t}. W is defined as the product of the second t moduli: W=m_{t+1}m_{t+}2 . . . m_{2t}. By kbit moduli, we mean 2^{k1}≦m_{i <}2k. This means that M >2^{n+1 }and W >2^{n+1}. Additionally, m_{i} ^{−1 }mod m_{j }are calculated for i,j=1 . . . 2t with i≠j.
 [0040]During the precomputation phase 12, p_{i }is also defined 16 such that p is an nbit number and p_{i}=p mod m_{i }for i=t+1 . . . 2t. Additionally, p^{−1} _{i }is calculated for i=1 . . . t. Note that p must be relatively prime to M and W, and p is usually prime.
 [0041]During a setup phase 18, A_{i }and B_{i }are defined 20 for nbit numbers A and B. To multiply A and B modulo p, the numbers are rendered in RNS notation so that A_{i}=A mod m_{i }and B_{i}=B mod m_{i }and p_{i}=p mod m_{i }for i=1 . . . 2t in both RNS bases.
 [0042]The rest of the shotgun multiplication process depicted in FIGS. 1A and 1B all falls within the body phase 22.
 [0043]It takes as parameters arguments A and B from 20 and modulus p in Residue Number System (RNS) notation from 16 for a first RNS basis (moduli m_{1}, . . . m_{t}) and for a second RNS basis (moduli m_{t+1}, . . . m_{2t}) from 14. Its output 40 is R=ABM^{−1 }mod p expressed in the both the first and the second RNS bases. This allows the outputs 40 to be used as inputs in subsequent multiplications. As in 14, M is the product of the moduli in the first RNS basis. And as also in 14, W is the product of the moduli in the second RNS basis.
 [0044]Shotgun multiplication facilitates the necessary computations by working in the first basis where computing a multiple of M is easy and then converting to the second basis where division by M is easy.
 [0045]This basis conversion is done by means of deriving the Mixed Radix System (MRS) digits of a number in one basis, and computing the corresponding sum in the other basis. This technique lends itself to parallel computations. In general the process performs the following sequence of steps:
 [0046]Step 1: In the first basis compute Q mod M such that AB+Qp=RM for some integral value R. This is equivalent to the computation:
 [0047]AB+Qp=0 mod M
 [0048]or
 [0049]Q=−ABp^{−1 }mod M.
 [0050]Step 2: Convert Q to the second basis, Q mod W.
 [0051]Step 3: Compute R in the second basis, R mod W.
 [0052]R=(AB +Qp)M^{−1 }mod W
 [0053]Note that M^{−1 }exists in the second basis (mod W) but not in the first where M mod M=0. Also note that
$\begin{array}{c}R\ue89e\text{\hspace{1em}}\ue89e\mathrm{mod}\ue89e\text{\hspace{1em}}\ue89ep=\left(\mathrm{AB}+\mathrm{Qp}\right)\ue89e{M}^{1}\ue89e\mathrm{mod}\ue89e\text{\hspace{1em}}\ue89ep\\ ={\mathrm{ABM}}^{1}+{\mathrm{QM}}^{1}\ue89ep\ue89e\text{\hspace{1em}}\ue89e\mathrm{mod}\ue89e\text{\hspace{1em}}\ue89ep\\ ={\mathrm{ABM}}^{1}\ue89e\mathrm{mod}\ue89e\text{\hspace{1em}}\ue89ep,\end{array}$  [0054]which is the answer we are looking for.
 [0055]Step 4: Convert R back to the first basis so that it can be used as input to the next multiplication.
 [0056]The strength of this process lies in the fact that there are many operands that do not depend on A or B, depending only on p or the m_{i}. These operands can be precomputed one time for many different p in the same size range and stored for repeated reference.
 [0057]The set of Q_{i}'s is the set of RNS values corresponding to Q=−ABp^{−1 }mod M. The RNS values Q_{i }are computed as Q_{i}=−A_{i}B_{i}p^{−l} _{i }mod m_{i }for i=1 . . . t in 24. Note that the Q_{i}'s are computed without reference to Q, and p^{−1 }mod M is a precomputed value as described above.
 [0058]In Steps 2630, Q is then converted from the RNS basis (m_{1}, m_{2}, . . . m_{t}) to RNS basis (M_{t+1}, M_{t+2}, . . . m_{2t}) by computing the MRS expansion Q=Q#_{1}+Q#_{2}m_{1}+Q#_{3}m_{1}m_{2 }+ . . . +Q#_{t}m_{1}m_{2 }. . . m_{t−1}. To perform this expansion, Q_{i=}0 for i=t+1 . . . 2t. Q#_{1}=Q_{1}. Counter j is set to zero.
 [0059]In step 28, the counter is incremented: j=j +1.
 [0060]In step 29, j is compared to t. If j is less than or equal to t, then Q#j is computed in 30:
 [0061]Q#_{j}=( . . . ((Q_{j}−Q#_{1})m_{1} ^{−1}−Q#_{2})m_{2} ^{−1}− . . . Q#_{j−1})m_{j−1} ^{−1 }and the second basis values of Q_{i }are updated:
 [0062]Q_{i}=Q_{j}+Q#_{j}(m_{1}m_{2 }. . . m_{j−1}) for i=t +1, . . . 2t.
 [0063]Then the process returns to step 28, where the counter is again incremented, etc.
 [0064]But if, in step 29, j is greater than t, the conversion of Q to the second basis is complete, i.e. Q_{i}=Q mod m_{i}, for i=t +1 . . . 2t.
 [0065]Then in 31 the set of R_{i}'s is the set of RNS values corresponding to R mod p=ABM^{−1 }mod p. The RNS values R_{i }are computed as R_{i}=(A_{i}B_{i}+Q_{i}p_{i})(M^{−1}) mod m_{i }for i =t+1 . . . 2t. Note that the R_{i}'s are computed without reference to R. Also note that (M^{−1}) mod m_{i }is also a precomputed value.
 [0066]Because this multiplication process is used recursively when doing exponential operations, R is converted from the second RNS basis (m_{t+1}, m_{t+2}, . . . m_{2t}) to the first RNS basis (m_{1}, M_{2 }. . . m_{t}) by computing the MRS expansion R=R#_{t+1}+R#_{t+2}m_{t+1}+R#_{t+3}m_{t+1}m_{t+2}+ . . . +R#_{2t}m_{t+1}m_{t+2 }. . . m_{2t−1. }
 [0067]Then in 32, R_{i=}0 for i=1 . . . t. R#_{t+1}=Rt+1. Counter j is set to t+1.
 [0068]In step 34, the counter is incremented: j=j +1.
 [0069]In step 36, j is compared to 2t. If j is less than or equal to 2t, then R#_{j }is computed in step 38:
 [0070]R#_{j}=(. . . ((R_{j}−R#_{t+1})m_{t+1} ^{−1}−R#_{t+2})m_{t+2} ^{−1 }− . . . R#_{j−1} ^{−1})m_{j−1} ^{−1 }mod m_{j }
 [0071]R_{i}=R_{i}+R#_{j}(m_{t+1}m_{t+2 }. . . m_{2t}) for i=1 . . . t.
 [0072]Then the process loops back to step 34, where the counter is again incremented and so on.
 [0073]If, in step 36, j is greater than 2t, the result 40 is obtained:
 [0074]R_{i}=(ABM^{−1 }mod p) mod m_{i}, for i=1 . . . 2t.
 [0075]If another iteration of the shotgun multiplication process of FIGS. 1A and 1B follows, then this R_{i }would go into the subsequent shotgun multiplication iteration. The subsequent iteration would include body 22, with the R_{i }being used in place of A_{i}.
 [0076]In an embodiment, shotgun multiplication is best described as follows:
 [0077]Shotgun ring operations for cryptographic purposes, or for other technical, commercial or governmental purposes, are highspeed ways of adding, negating, subtracting and multiplying numbers.
 [0078]The Chinese Remainder Theorem gives a constructive definition of a useful ring isomorphism between two important commutative rings with unity, the ring Z/mZ of integers modulo m, and a related product ring P, the product being over factor rings indexed by the members of an appropriate index set of pairwise relatively prime divisors of m.
 [0079]Shotgun arithmetic proceeds by performing a succession of operations involving members a, b, c, . . . of the ring Z/mZ, as follows:
 [0080]Step 1: “Shatter” member a into many “shards”, one belonging to each factor ring F of the product ring P. In other words, use the CRT to “encode” the integer a into the integer a mod f if the factor ring F is equal to Z/fZ. Similarly shatter members b, c, . . . .
 [0081]Step 2(a): Appropriately operate on the Fshards of the members of Z/mZ involved in the first operation. Do this separately, for each F, so as to accumulate a family of resultshards corresponding to the first operation of the desired succession of operations, one resultshard belonging to each factor ring F.
 [0082]Step 2(b): Remain at the shard level, and do the next appropriate operation within each factor F, producing a next family of resultshards, one for each F.
 [0083]Step 2(c): And again. And again. . . . Never departing from the shard level, which is to say from operations with each single factor ring F.
 [0084]Step 3: When the desired succession of ring operations on numbers belonging to the ring Z/mZ has been mimicked by an actual succession of corresponding families of F ring operations on shardlevel in the separate factor rings F, it is necessary to “unshatter” the family of final shardresults, one in each factor ring F. In accordance with the CRT, this is done by the Euclidean Algorithm methodology.
 [0085]SLIDING WINDOW SARY EXPONENTIATION
 [0086][0086]FIG. 2 depicts a method for exponentiation mod prime p through repeated squarings and multiplications. This flow introduces data, specifically the m_{i }moduli that are essential in the shotgun multiplication process used in each of the demarcated boxes. A shotgun multiplication process is detailed in FIGS. 1A and 1B. The exponentiation method ultimately calculates A^{d }mod p.
 [0087]In 42, message A has a bit length of n bits. The message A could be any number or other information represented in a digital format. Method parameters are shown in 44. In 46, kbit moduli (m_{1}, m_{2}, . . . m_{2t}) are chosen, where the moduli m_{i }are pairwise relatively prime and t≧(n+1)/k. And also in 46, M is defined as the product of the first t moduli: M=m_{1}m_{2 }. . . m_{t}.
 [0088]As a first part of a key 48 a modulus p is input 50, where p is an nbit prime modulus.
 [0089]In 52 the message A and modulus p are rendered in RNS notation so that A_{i}=A mod m_{i }and p_{i}=p mod m_{i }for i=1 . . . 2t. The modular inverse of p is also calculated p^{−1} _{i}=p^{−1 }mod m_{i }for i=1 . . . 2t.
 [0090]The second parameter 44 is a sliding window width s shown in 53. The sliding window width s is chosen (and fixed for a given implementation) by weighing the cost of storage ˜t(k)(2^{s}) bits against the cost of computation ˜2^{s}+n+n/s multiplications. Sliding window widths in the range of 1 to 6 would be common.
 [0091]Using the shotgun multiplication process in 54, L_{ji }is computed such that L_{ji}=(A^{J}M^{J} ^{−1 }mod p) mod m_{i}, for j=0. . .2^{s −1 }and i =1 . . . 2t. And:
 L_{0=}1
 L_{1}=A
 L_{2}=SG(L_{1},A)=L_{1}AM^{−1 }
 L_{j}=SG(L_{j−1},A)=L_{j−1}(AM^{−1})=A^{j−1}M^{j−2}(AM^{−1})=A^{j}M^{j−1 }
 [0092]where SG( ) denotes shotgun multiplication.
 [0093]As a second part of key 48, input 60 is a 2nbit exponent d. In 62 a variable c is set equal to d mod (p−1). And in 64 variable pointer cbits is set equal to the number of bits in c.
 [0094]In step 65, a variable b is set equal to the first s bits of c. In step 66, a variable T_{i }is set equal to L_{bi}.
 [0095]The determination 68 is then made of whether there are more bits in c to process. If yes, then in 70 b=s bits of c, starting at cbits. Then in 71, cbits=cbitss.
 [0096]The shotgun multiplication process is repeated s times in 72, each time setting T=T^{2}M^{−1 }mod p, where T_{i}=T mod m_{i}, wherein T is realized in RNS notation, T_{i}=T mod m_{i}, i=1 . . . 2t. The shotgun multiplication process is then used in 74 to set T=TL_{b}M^{−1 }mod p, wherein T is realized in RNS notation, T_{i}=T mod m_{i}, i=1 . . . 2t.
 [0097]The method then loops to make determination 68 again and so on.
 [0098]If the determination 68 is no, the shotgun multiplication process is used in 76 to set T=TM^{delta(c) }mod p, wherein T is realized in RNS notation, T_{i}=T mod m_{i}, i=1 . . . 2t, and wherein delta(c) is the number of powers of M^{−1 }accumulated in the shotgun multiplications, including squarings, in the 68707274 loop. Because delta(c) is solely determined by c, it can be precomputed.
 [0099]Finally, in 78 T is recovered from T_{i }using the Chinese Remainder Theorem (CRT). In fact, T=A^{d }mod p.
 [0100]EXPONENTIATION MOD PQ USING CRT
 [0101][0101]FIG. 3 depicts a method of using CRT to break a 2nbit exponentiation into two nbit exponentiations (which in practice are each one eighth as expensive.) It requires that the prime factors p and q of the modulus N be known. It employs the sliding window exponentiation process described in the second flow.
 [0102]The process begins in 80 with a 2nbit message A. Then a key 82 is chosen 84. The components 84 of key 82 include nbit prime numbers p and q, and a 2nbit exponent d.
 [0103]In step 86, A_{p }and A_{q }are computed:
 A_{p}=A mod p
 1 A_{q}=A mod q
 [0104]Then the sliding window exponentiation process is used in 88 to compute A_{P} ^{d }mod p in 90 and A_{q} ^{d }mod q in 92.
 [0105]Finally in 94, A^{d }mod (pq) is constructed using CRT.
 [0106]CASTOUT
 [0107]The shotgun multiplication method can be used more efficiently by choosing the bases (m_{1}, . . . m_{2t}) in ways that make the modular calculations simpler. A wbit number C is a “castout modulus” if it is of the form 2 ^{w}−L, where L is a low Hamming weight odd integer less than 2^{(w−3)/2}, i.e., C=2^{w}−2^{x2}− . . . −2^{xk}−1, where (w−3)/^{2}>x_{1}>x_{2}> . . . >X_{k>}0 and k is much less than w. The “castout order” of C is defined to be one less than the Hamming weight of L.
 [0108]The residue of a modulo <2^{2w }a wbit castout modulus can be found using only 2k+3 additions, 2k multiplications by 2^{x}(shifts) and a single bit comparison, where k is the castout order of the modulus.
 [0109][0109]FIG. 4 illustrates the castout process.
 [0110]Let C be a wbit castout modulus of order k in 96 such that
 C 2^{w}−2^{x1}−2^{x2 }− . . . −2^{xk}−1.
 [0111]And let P be a number <^{2w }in 98.
 [0112]Then in 100, consider P as two wbit words H_{1 }and L_{1 }wherein
 P=2^{w}H_{1}+L_{1}, with L_{1 <}2^{w }and H_{1 <}2^{w}.
 [0113]Step 1: This step 102 computes S_{1} 104:
 S_{1}=L_{1}+(H_{1 }2^{x1})+(H_{1 }2^{x2})+ . . . +(H_{1}2^{xk})+H_{1 }
 [0114]Step 2: This step 106 splits S_{1} 108 and computes S_{2} 110: Consider S_{1 }as two wbit words H_{2 }and L_{2 }Such that S_{1=}2^{w}H_{2}+L_{2 }Compute S_{2}=L_{2}+(H_{2}2^{x1}) +(H_{2}2^{x2})+. . . +(H_{2 }2^{xk}) +H_{2 }
 [0115]Step 3: This step 112 computes S_{3} 114: Compute S_{3}=S_{2}+(2^{x1}+ . . . +2^{xk +1})
 [0116]Step 4: This step 116 compares S_{3}>2^{w} 118, leading to either S_{3−}2^{w } 120 or S_{2} 122: If S_{3 }>2^{w}(the w +1 bit of S_{3 }is 1) then output S_{3 −}2^{w}(the low w bits of S_{3}), otherwise output S_{2 }
 [0117]Justification:
$\begin{array}{c}P={2}^{w}\ue89e{H}_{1}+{L}_{1}\\ ={H}_{1}*\left(C+{2}^{x\ue89e\text{\hspace{1em}}\ue89el}+\dots +{2}^{x\ue89e\text{\hspace{1em}}\ue89ek}+1\right)+{L}_{1}\\ ={L}_{1}+{2}^{x\ue89e\text{\hspace{1em}}\ue89el}\ue89e{H}_{1}+\dots +{2}^{x\ue89e\text{\hspace{1em}}\ue89ek}\ue89e{H}_{1}+{H}_{1}+{H}_{1}\ue89eC\\ ={S}_{1}+{H}_{1}\ue89eC,\end{array}\hspace{1em}$  [0118]so S_{1}=P mod C.
$\begin{array}{c}A\ue89e\text{\hspace{1em}}\ue89el\ue89e\text{\hspace{1em}}\ue89es\ue89e\text{\hspace{1em}}\ue89eo,{S}_{1}=\text{\hspace{1em}}\ue89e{L}_{1}+\left({2}^{x\ue89e\text{\hspace{1em}}\ue89el}+\dots +{2}^{x\ue89e\text{\hspace{1em}}\ue89ek}+1\right)\ue89e{H}_{1}<\\ \text{\hspace{1em}}\ue89e{L}_{1}+2\ue89e\left({2}^{x\ue89e\text{\hspace{1em}}\ue89el}\right)\ue89e{H}_{1}<\\ \text{\hspace{1em}}\ue89e{2}^{w}+2\ue89e\left({2}^{\left(w3\right)/2}\right)\ue89e{2}^{w}\\ =\text{\hspace{1em}}\ue89e{2}^{w}\ue89e\left({2}^{\left(w1\right)/2}+1\right)<\\ \text{\hspace{1em}}\ue89e{2}^{w}\ue89e\left({2}^{\left(w1\right)/2}\right)\\ =\text{\hspace{1em}}\ue89e{2}^{\left(3\ue89ew+1\right)/2}\end{array}\hspace{1em}$  [0119]S_{1}=2^{w}H_{2}+l_{2}, with L_{2}<2^{(w+1)y2 }
$\begin{array}{c}{S}_{1}={2}^{w}\ue89e{H}_{2}+{L}_{2}\\ ={H}_{2}\ue8a0\left(C+{2}^{x\ue89e\text{\hspace{1em}}\ue89el}+\dots +{2}^{x\ue89e\text{\hspace{1em}}\ue89ek}+1\right)+{L}_{2}\\ ={L}_{2}+{2}^{x\ue89e\text{\hspace{1em}}\ue89el}\ue89e{H}_{2}+\dots +{2}^{x\ue89e\text{\hspace{1em}}\ue89ek}\ue89e{H}_{2}+{H}_{2}+{H}_{2}\ue89eC\\ ={S}_{2}+{H}_{2}\ue89eC,\end{array}\hspace{1em}$  [0120]so S_{2}=S_{1}=P mod C.
$\begin{array}{c}A\ue89e\text{\hspace{1em}}\ue89el\ue89e\text{\hspace{1em}}\ue89es\ue89e\text{\hspace{1em}}\ue89eo,{S}_{2}=\text{\hspace{1em}}\ue89e{L}_{2}+\left({2}^{x\ue89e\text{\hspace{1em}}\ue89el}+\dots +{2}^{x\ue89e\text{\hspace{1em}}\ue89ek}+1\right)\ue89e{H}_{2}<\\ \text{\hspace{1em}}\ue89e{L}_{2}+2\ue89e\left({2}^{x\ue89e\text{\hspace{1em}}\ue89el}\ue89e{H}_{2}\right)<\\ \text{\hspace{1em}}\ue89e{2}^{w}+2\ue89e\left({2}^{\left(w3\right)/2}\right)\ue89e{2}^{\left(w+1\right)/2}\\ =\text{\hspace{1em}}\ue89e{2}^{w}+{2}^{\left(2\ue89ew1\right)/2}<\\ \text{\hspace{1em}}\ue89e{2}^{w+1}<\\ \text{\hspace{1em}}\ue89e2\ue89eC\end{array}\hspace{1em}$  [0121]If S_{3}≧2^{w}, then
$\begin{array}{c}{S}_{3}{2}^{w}={S}_{2}+\left({2}^{x\ue89e\text{\hspace{1em}}\ue89el}+\dots +{2}^{x\ue89e\text{\hspace{1em}}\ue89ek}+1\right){2}^{w}\\ ={S}_{2}C\\ =P\ue89e\text{\hspace{1em}}\ue89em\ue89e\text{\hspace{1em}}\ue89eo\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\hspace{1em}}\ue89e\text{\hspace{1em}}\ue89eC,a\ue89e\text{\hspace{1em}}\ue89en\ue89e\text{\hspace{1em}}\ue89ed\end{array}\ue89e\hspace{1em}\text{}\ue89ea\ue89e\text{\hspace{1em}}\ue89en\ue89e\text{\hspace{1em}}\ue89ed\ue89e\text{\ue891}\ue89e\begin{array}{c}{S}_{3}={S}_{2}C<2\ue89eCC\\ =C\end{array}\hspace{1em}$  [0122]Otherwise, if S_{3}<2^{w}, then
 [0123]S_{2}+(2^{x1}+ . . . +2^{xk}+1)<2^{w}, so
 [0124]S_{2}<C
 [0125]And S_{2}=P mod C as shown above
 [0126]Computation of S_{1 }and S_{2 }take k +1 additions and k shifts each. Computation of S_{3 }takes one addition, and the decision on what to output is a onebit comparison. These total 2k+3 additions, 2k shifts and one onebit comparison.
 [0127]In order to find the residue, modulo C, therefore, it is only necessary to calculate 104 S_{1 }using Step 1 in 102, calculate 110 S_{2 }using Step 2 in 106, calculate 114 S_{3 }using Step 3 in 112 and perform a onebit compare 118 of S_{3 }against 2^{w }and output either S_{3−}2^{w }in 120 or S_{2 }in 122, depending on the result of the compare 118.
 [0128]The residue calculated in this fashion can be used in a variety of processes, particularly to perform large number exponentiation in public key cryptography.
 [0129]GENERALIZATION OF CASTOUT
 [0130]Some embodiments select castout moduli from two sets of numbers: (1) big and heavy numbers or (2) little and light numbers.
 [0131]A definition of a “wbig” number used by some embodiments is: a wbig number is a number less than 2^{w }but close to 2^{w}. A definition of a “wheavy” number used by some embodiments is: a wheavy number is a number less than 2^{w }and with Hamming weight close to w.
 [0132]A definition of a “wlittle” number used by some embodiments is: a wlittle number is a number greater than 2^{w }but close to 2^{w}. A definition of a “wlight” number used by some embodiments is: a wlight number is a number greater than 2^{w }and with Hamming weight close to 1.
 [0133]Another definition of a “wbig” number used by some embodiments is: a wbig number is greater than >2^{w−}2^{gw}, where g is a number less than 1. That is, the upper w(1−g) bits of the wbig number are 1 when the wbig number is written in binary notation. For example, one embodiment defines a wbig wheavy number by g=½ and x−w≦6.
 [0134]Some embodiments achieve computational advantages by using a castout modulus that is both wbig and wheavy. Some embodiments achieve computational advantages by using a castout modulus that is both wlittle and wlight. The detailed computational discussion in this application of the use of a castout modulus that is both wbig and wheavy applies to the use of a castout modulus that is both wlittle and wlight with minor changes that are obvious to one of ordinary skill in the art.
 [0135]Other moduli than wbig and wheavy moduli as castout moduli would be used in other embodiments, and are therefore contemplated as falling within the scope of the claimed invention. And other moduli than wlittle and wlight moduli as castout moduli would be used in other embodiments, and are therefore contemplated as falling within the scope of the claimed invention.
 [0136]OTHER EMBODIMENTS
 [0137]A factor in slowing some publicprivate key cryptosystem processes is their requirement for modular exponentiation of large numbers. Even though this description most thoroughly focuses on encryption/decryption embodiments, many other embodiments are contemplated. Examples of other embodiments—readily apparent to typical practitioners of this technical area—include (1) tomography/transforming data, (2) decryption/encryption, (3) keyless encryption, (4) combination transforming/detransforming, (5) random number generation/monte carlo, (5) simulation of reallife scenarios, etc. Those applications typically require heavy exponentiation and for that and other reasons would be particularly well adapted to application of the present invention.
 [0138]In an embodiment, shotgun multiplication is used to facilitate high security logins that use highdegreesparse polynomials. One example is Purdy. See G. B. Purdy, “A high security login procedure”, Communications of the ACM, 17 (1974), 442445.
 [0139]In another embodiment, shotgun multiplication facilitates random number generation by staying shattered, generating new random strings indefinitely, with a cleanup unshatterer following to provide random numbers. One function example is LCPRN.
 [0140]In a further embodiment, shotgun multiplication facilitates Monte Carlo.
 [0141]In a yet another embodiment, shotgun multiplication facilitates simulation.
 [0142]In a still further embodiment, shotgun multiplication facilitates speed acceleration of computer games.
 [0143]In an embodiment, shotgun multiplication facilitates genetic algorithms.
 [0144]In another embodiment, shotgun multiplication facilitates fractals.
 [0145]In a further embodiment, shotgun multiplication facilitates morphing.
 [0146]In a yet another embodiment, shotgun multiplication facilitates morphing particularly well for use in movie production.
 [0147]In a still further embodiment, shotgun multiplication facilitates movie special effects, including random and nonrandom processes.
 [0148]In other embodiments, shotgun multiplication facilitates secret sharing, some going into higher dimensional vector spaces, some over larger fields, and some involving ramp schemes.
 [0149]In another embodiment, shotgun multiplication facilitates improved implementation of the invention disclosed in U.S. Pat. No. 5,485,474, “Scheme For Information Dispersal and Reconstruction,” Rabin et al.
 [0150]In further embodiments, shotgun multiplication facilitates extremely precise real calculations. Some of these are done as largeinteger modular calculations, and some of these are done as largemodulus modular calculations. Error growth is minimized in some, and eliminated in others.
 [0151]In yet other embodiments, shotgun multiplication facilitates transforms/retransforms. Examples of transforms/retransforms facilitated include Fourier, Laplace, Walsh, etc. Examples of classes facilitated include classical harmonic analysis, wavelet transforms, tomography, scattering, inverse scattering, sonar, and stealth technology.
 [0152]Any element in a claim that does not explicitly state “means for” performing a specified function, or “step for” performing a specific function, is not to be interpreted as a “means” or “step” clause as specified in 35 U.S.C. § 112, ¶6. In particular, the use of “step of” in the claims herein is not intended to invoke the provision of 35 U.S.C. § 112, ¶ 6.
 [0153]It should be apparent from the foregoing that an invention having significant advantages has been provided. While the invention is shown in only a few of its forms, it is not just limited to those forms but is susceptible to various changes and modifications without departing from the spirit thereof.
 [0154]APPENDIX A—GLOSSARY
 [0155]This Glossary defines words as they are used throughout this application. This Glossary lists base words rather than word variations. But the meanings of word variations—such as “connecting,” “connect,” and “connected” for the base word “connection”—are also given meaning according to their logical relationship to the base word.
 [0156]“=” means equality or congruence, depending on the context. This is clear to typical practitioners of this technical area.
 [0157]“˜” means approximately.
 [0158]“algorithm” means a process for completing a task. An encryption algorithm is the process, typically with mathematical characteristics, to encrypt and decrypt messages.
 [0159]“ARP” means Address Resolution Protocol. To map an IP address into a hardware address, a computing device uses the ARP protocol which broadcasts a request message containing an IP address, to which a target computing device replies with both the original IP address and the hardware address.
 [0160]“Asymmetric encryption” means encryption used in a publicprivate key cryptosystem.
 [0161]“Asymmetric key cipher” means a publicprivate key cryptography system.
 [0162]“Authentication” means the process of verifying that a file or message has not been altered in route from the distributor to the recipient(s).
 [0163]“Cipher” means a cryptographic algorithm used to encrypt an decrypt files and messages.
 [0164]“Ciphertext” means the disguised (or encrypted) file or message.
 [0165]“Computing device” means a device having at least one processor and at least one memory device, wherein the processor can process data that can be stored in the memory device before and/or after processing, or a group of devices having that capacity in combination. By this definition, examples of a computing device include computer personal computer, palm computing device, notebook computer, server, mainframe, network of computing devices with coordinated processing or storage, network of components functioning together as a computing device wherein any single component may not be a computing device in its own right, etc. As another example, components of a computing device may be connected across the Internet. Other examples of computing devices could include boards, chips, exponentiators, multipliers, etc.
 [0166]“Connection” means any connection that is adapted to carry communication, whatever the supporting technology. Examples of connections include hard wire connections such as phone lines, T1 lines, DSL, fiber optic, Ethernet, twisted pair, etc. Other examples of connections include wireless connections such as those operating by electromagnetic waves, wireless optics (e.g., infrared), etc. Further examples are a logical connection between two processes on the same system, and a connection between two processes sharing a common memory space.
 [0167]“Cryptanalysis” means the art of breaking cryptosystems. It also means the process of looking for errors or weaknesses in the implementation of an algorithm or of the algorithm itself.
 [0168]“Cryptography” is the art of creating and using cryptosystems.
 [0169]“Cryptosystem” means the entire process of using cryptography. This includes the actions of encrypting and decrypting a file or message. It also means authenticating the sender of an email message.
 [0170]“Decryption” means any process to convert ciphertext back into plaintext. Decrypting is synonymous to decoding.
 [0171]“DES” means the Data Encryption Standard. It is a cipher developed by the U.S. government in the 1970s to be the official encryption algorithm of the U.S.
 [0172]“Digital signature” means systems that allow people and organizations to electronically certify such features as their identity, their ability to pay, or the authenticity of an electronic document.
 [0173]“Encryption” means any process to convert plaintext into ciphertext. Encrypting is synonymous to encoding.
 [0174]“FTP” means File Transfer Protocol. FTP enables transferring of text and binary files over TCP connections. FTP allows transferring files according to a strict mechanism of ownership and access restrictions. It is now one of the most commonly used protocols over the Internet.
 [0175]“Hamming weight” means the number of “1” bits in the binary representation of a number.
 [0176]“HTTP” means Hyper Text Transfer Protocol. It is a protocol used to transfer hypertext pages across the World Wide Web.
 [0177]“IP” means Internet Protocol, and is the underlying protocol for the other Internet protocols. IP defines the means to identify and reach a target computer on the network. A unique number known as an IP address identifies each computing device in the IP world.
 [0178]“IPSec” means Internet Protocol Security. It is a standard for security at the network or packetprocessing layer of network communication. IPSec provides two choices of security service: Authentication Header (AH), which essentially allows authentication of the sender of data, and Encapsulating Security Payload (ESP), which supports both authentication of the sender and encryption of data. IPSec is a suite of protocols that protect client protocols of IP, such as TCP. IPSec describes mechanisms that provide data source authentication, data integrity, confidentiality and protection against replay attacks. IPSec provides transport mode and tunnel mode operation. Some embodiments provide only tunnel mode operation, and others offers a more complete IPSec implementation.
 [0179]“iSCSI” is a software package that emulates SCSI protocols, but the connection method is via an IP network instead of a direct SCSI compatible cable. This is one example of IPbased storage.
 [0180]“Key” means a collection of bits, usually stored in a file, which is used to encrypt or decrypt a message.
 [0181]“Network protocol” means a standard designed to specify how computers interact and exchange messages. It usually specifies the format of the messages and how to handle errors. The following Internet protocols are examples of network protocols: ARP, FTP, HTTP, IP, NNTP PPP, SLIP, SMTP, SNMP, TCP, Telnet, and UDP.
 [0182]“NNTP” means Network News Transfer Protocol. It is a protocol used to carry USENET postings between News clients and USENET servers.
 [0183]“PGP” means Pretty Good Privacy. It is a publicprivate key cryptosystem that allows users to more easily integrate the use of encryption in their daily tasks, such as email protection and authentication, and protecting files stored on a computer. PGP is available for free to individual home users.
 [0184]“Plaintext” means the original message or file. After a file or message has been encrypted and then decrypted you should end up with the original file or message.
 [0185]“PPP” means PointToPoint protocol, and is a protocol for creating a TCP/IP connection over both synchronous and asynchronous systems. PPP provides connections for hosttonetwork or routertorouter. It also has a security mechanism. PPP is well known as a protocol for connections over regular telephone lines using modems on both ends. This protocol is widely used for connecting personal computers to the Internet.
 [0186]“Private key” means the private key of a publicprivate key cryptosystem. This key is used to digitally sign outgoing messages and is used to decrypt incoming messages.
 [0187]“Public key” means the public key of a publicprivate key cryptosystem. This key is used to confirm digital signatures on incoming messages or to encrypt a file or message so that only the holder of the private key can decrypt the file or message.
 [0188]“Public key cryptosystem” means an asymmetric encryption algorithm in which it is infeasible to derive one key from the other.
 [0189]“Publicprivate key cryptosystem” means a cryptosystem that uses two different keys to encrypt and decrypt messages and files. The two keys are mathematically related to each other, but deriving one key from the other is infeasible. One key is a public key and one key is a private key. The public key is usually distributed to other users, and the private key is usually kept secret.
 [0190]“Ring arithmetic” means an arithmetic of mathematical structures in which addition, subtraction, multiplication, and their obvious consequences such as exponentiation, have the properties and interrelationships usually encountered in high school algebra.
 [0191]“SCSI” is an intelligent protocol that enables data blocks to be read at high speed from or sent at high speed to storage devices such as disks or tape drives. Early implementations of SCSI used ribbon cable and industry standard logic levels.
 [0192]“Security association” means a relationship between two or more entities that describes how the entities will utilize security services to communicate securely. This relationship is represented by a set of information that can be considered a contract between the entities. The information must be agreed upon and shared between all the entities. Security association is commonly abbreviated SA.
 [0193]“Shotgun multiplication” means a process like that described in this application for performing fast computations by performing processing in mathematically independent units, taking advantage of more than one basis and precomputed operands, and accommodating iterative problems.
 [0194]“SLIP” means Serial Line Internet Protocol, and is a pointtopoint protocol to use over a serial connection, a predecessor of PPP. There is also an advanced version of this protocol known as CSLIP (compressed serial line internet protocol) that reduces overhead on a SLIP connection by sending just header information when possible, thus increasing packet throughput.
 [0195]“SMTP” means Simple Mail Transfer Protocol, and is dedicated to sending email messages originating on a local host to a remote server over a TCP connection. SMTP defines a set of rules that allows two programs to send and receive email over the network. The protocol defines the data structure to deliver with information regarding the sender, the recipient(s) and the email's body.
 [0196]“SNMP” means Simple Network Management Protocol. It is a simple protocol that defines messages related to network management. Through the use of SNMP, network devices such as routers can be configured by any host on their network.
 [0197]“SSL” means Secure Sockets Layer, and is a trademark of Netscape. It is a program layer created by Netscape for managing the security of message transmissions in a network. The concept is that the programming for keeping messages confidential is to be contained in a program layer between an application (such as a Web browser or HTTP) and the Internet's TCP/IP layers. The “sockets” part of the term refers to the sockets method of passing data back and forth between a client and a server program in a network or between program layers in the same computer.
 [0198]“SSL/TLS” means compatible with SSL and with TLS.
 [0199]“Symmetric key” means the key of a symmetric key cryptosystem. The symmetric key is used to encrypt a file or message and also to decrypt the file or message.
 [0200]“Symmetric key cryptosystem” means a cryptosystem that uses one key to lock and unlock—encrypt and decrypt—messages and files. The sender must posses the key to encrypt a file or message, and the recipient(s) must possess the key to decrypt the file or message.
 [0201]“TCP” means Transmission Control Protocol. Like UDP, TCP is a protocol that enables a computer to send data to a remote computer. But unlike UDP, TCP is reliable —packets are guaranteed to wind up at their target in the correct order.
 [0202]“Telnet” is a terminal emulation protocol for use over TCP connections. It enables users to login to remote hosts and use their resources from the local host.
 [0203]“TLS” means Transport Layer Security. It is the successor protocol to SSL, created by the Internet Engineering Task Force (IETF) for general communication authentication and encryption over TCP/IP networks. TLS version 1 is nearly identical with SSL version 3, providing data integrity and privacy on a communications link over the Internet. It allows clientserver applications to communicate and is designed to prevent eavesdropping, message forgery, and interference.
 [0204]“TOE” means TCP Offload Engine. TOE technology typically takes the server CPU out of I/O processing by shifting TCP/IP processing tasks to a network adapter or storage device. This leaves the CPU free to run its applications, so users get data faster.
 [0205]“Triple DES” means a method of improving the strength of the DES algorithm by using it three times in sequence with different keys.
 [0206]“UDP” means User Datagram Protocol. It is a simple protocol that transfers datagrams (packets of data) to a remote computer. UDP doesn't guarantee that packets will be received in the order sent or that they will arrive at all.
Claims (31)
 A1. A method of encrypting data comprising:performing a ring arithmetic function on numbers, including:using a residue number multiplication process;converting to a first basis using a mixed radix system; andconverting to a second basis using a mixed radix system.
 A2. The method of
claim A1 , wherein the ring arithmetic function includes multiplication.  A3. The method of
claim A1 , wherein the ring arithmetic function includes addition.  A4. The method of
claim A1 , wherein the ring arithmetic function includes subtraction.  A5. The method of
claim A1 , wherein the data is encrypted using asymmetric encryption.  A6. The method of
claim A1 , wherein the data is encrypted using symmetric encryption.  A7. The method of
claim A1 , further comprising:choosing a modulus C for modular calculations;wherein the modulus C is wbig; andwherein the modulus C is wheavy.  A8. The method of
claim A7 , wherein the modulus C is of the form 2 w −L; andwherein L is a low Hamming weight odd integer less than 2^{(w−1})^{/2}.  A9. The method of
claim A8 , further comprising:calculating the modulus C by a process including:splitting P into 2 wbit words H_{1 }and L_{1};calculating S_{1}=L_{1}+(H_{1 }2^{x2})+(H_{1 }2^{x2})+ . . . +(H_{1}2^{xk})+H_{1};splitting S_{1 }into two wbit words H_{2 }and L_{2};computing S_{2}=L_{2}+(H_{2 }2^{x1})+(H_{2 }2^{x2})+ . . . +(H_{2 }2^{xk}) +H_{2};computing S_{3}=S_{2}+(2^{x1}+ . . . +2^{xk}+1);determining the modulus C by comparing S_{3 }to 2^{w}, wherein the modulus C=S_{2 }if S_{3 <}2^{w}, and wherein the modulus C=S_{3 =}2^{w }if S_{3 ≧}2^{w}; andwherein the modulus C is a residue.  A10. The method of
claim A1 , further comprising:choosing a modulus C for modular calculations;wherein the modulus C is wlittle; andwherein the modulus C is wlight.  A11. The method of
claim A10 ,wherein the modulus C is of the form 2^{w}+L; andwherein the modulus C has a Hamming weight close to 1.  B1. A method of encrypting data comprising the steps of:choosing a first basis (m_{1}, m_{2}, . . . m_{t});choosing a second basis (m_{t+1}, m_{t+2}, . . . m_{2t});calculating a product M=M_{1}M_{2 }. . . m_{t; }calculating a product W=m_{t+1}m_{t+2 }. . . m_{2t}; andcalculating a product ABM^{−1 }mod p, wherein the calculating a product ABM^{−1 }mod p includes:computing Q mod M in the first basis such that AB+Qp=RM for some integral value R;converting Q to the second basis, Q mod W; andcomputing R in the second basis, R mod W, wherein R=(AB +Qp)M^{−1 }mod W and R mod p=ABM^{−1 }mod p.
 B2. The method of
claim B1 , further comprising converting R to the first basis, R mod M.  B3. The method of
claim B2 , further comprising:a second iteration of the method ofclaim B2; andwherein R is used as input to the subsequent iteration.  B4. The method of
claim B1 , wherein the data is encrypted using asymmetric encryption.  B5. The method of
claim B1 , wherein the data is encrypted using symmetric encryption.  C1. A method of encrypting data comprising:choosing a modulus C for modular calculations;wherein the modulus C is wbig; andwherein the modulus C is wheavy.
 C2. The method of
claim C1 ,wherein the modulus C is of the form 2^{w}−L; andwherein L is a low Hamming weight odd integer less than 2^{(w−1})^{2}.  C3. The method of
claim C2 , further comprising:calculating the modulus C by a process including:splitting P into 2 wbit words H_{1 }and L_{1};calculating S_{1}=L_{1}+(H_{1}2^{x1})+(H_{1}2^{x2})+ . . . +(H_{1 }2^{xk})+H_{1};splitting S_{1 }into two wbit words H_{2 }and L_{2};computing S_{2}=L_{2}+(H_{2 }2^{x1})+(H_{2 }2^{x2})+ . . . +(H_{2}2^{xk})+H_{2};computing S_{3}=S_{2}+(2^{x1}+ . . . +2^{xk} +1);determining the modulus C by comparing S_{3 }to 2^{w}, wherein the modulus C=S_{2 }if S_{3}<2^{w}, and wherein the modulus C=S_{3}−2^{w }if S_{3}>2^{w}; andwherein the modulus C is a residue.  D1. A method of encrypting data comprising:choosing a modulus C for modular calculations;wherein the modulus C is wlittle; andwherein the modulus C is wlight.
 D2. The method of
claim D1 ,wherein the modulus C is of the form 2^{w}+L; andwherein the modulus C has a Hamming weight close to 1.  E1. A method of hashing data comprising:performing a ring arithmetic function on numbers, including:using a residue number multiplication process;converting to a first basis using a mixed radix system; andconverting to a second basis using a mixed radix system.
 E2. The method of
claim E1 , wherein the ring arithmetic function includes multiplication.  E3. The method of
claim E1 , wherein the ring arithmetic function includes addition.  E4. The method of
claim E1 , wherein the ring arithmetic function includes subtraction.  E5. The method of
claim E1 , further comprising:choosing a modulus C for modular calculations;wherein the modulus C is wbig; andwherein the modulus C is wheavy.  E6. The method of
claim E5 ,wherein the modulus C is of the form 2^{w}−L; andwherein L is a low Hamming weight odd integer less than 2^{(w−1})/^{2}.  E7. The method of
claim E6 , further comprisingcalculating the modulus C by a process including:splitting P into 2 wbit words H_{1 }and L_{1};calculating S_{1}=L_{1}+(H_{1 }2^{x2})+(H_{1 }2^{x2}) + . . . +(H_{1 }2^{xk})+H_{1};splitting S_{1 }into two wbit words H_{2 }and L_{2};computing S_{2}=L_{2}+(H_{2 }2^{x1})+(H_{2 }2^{x2})+ . . . +(H_{2 }2^{xk})+H_{2};computing S_{3}=S_{2}+(2^{x1}+ . . . +2^{xk}+1);determining the modulus C by comparing S_{3 }to 2^{w}, wherein the modulus C=S_{2 }if S_{3 <}2^{w}, and wherein the modulus C=S_{3 −}2^{w }if S_{3}>2^{w}; andwherein the modulus C is a residue.  E8. The method of
claim E7 , wherein the method of hashing data comprises a method of cryptographic hashing.  E9. The method of
claim E1 , further comprising:choosing a modulus C for modular calculations;wherein the modulus C is wlittle; andwherein the modulus C is wlight.  E10. The method of
claim E9 ,wherein the modulus C is of the form 2^{w}+L; andwherein the modulus C has a Hamming weight close to 1.
Priority Applications (8)
Application Number  Priority Date  Filing Date  Title 

US28801501 true  20010502  20010502  
US30095501 true  20010626  20010626  
US30095701 true  20010626  20010626  
US32625201 true  20011001  20011001  
US32625001 true  20011001  20011001  
US32625101 true  20011001  20011001  
US32626601 true  20011001  20011001  
US10068294 US7218734B2 (en)  20010502  20020205  Ring arithmetic method, system, and apparatus 
Applications Claiming Priority (4)
Application Number  Priority Date  Filing Date  Title 

US10068294 US7218734B2 (en)  20010502  20020205  Ring arithmetic method, system, and apparatus 
US10078252 US7233970B2 (en)  20010502  20020216  Computational method, system, and apparatus 
PCT/US2002/013657 WO2002089399B1 (en)  20010502  20020501  Ring arithmetic method, system, and apparatus 
US11712227 US7853014B2 (en)  20010502  20070227  Ring arithmetic method, system, and apparatus 
Publications (2)
Publication Number  Publication Date 

US20030044004A1 true true US20030044004A1 (en)  20030306 
US7218734B2 US7218734B2 (en)  20070515 
Family
ID=27574493
Family Applications (2)
Application Number  Title  Priority Date  Filing Date 

US10068294 Active 20240118 US7218734B2 (en)  20010502  20020205  Ring arithmetic method, system, and apparatus 
US11712227 Active US7853014B2 (en)  20010502  20070227  Ring arithmetic method, system, and apparatus 
Family Applications After (1)
Application Number  Title  Priority Date  Filing Date 

US11712227 Active US7853014B2 (en)  20010502  20070227  Ring arithmetic method, system, and apparatus 
Country Status (2)
Country  Link 

US (2)  US7218734B2 (en) 
WO (1)  WO2002089399B1 (en) 
Cited By (51)
Publication number  Priority date  Publication date  Assignee  Title 

US20080198832A1 (en) *  20070215  20080821  Harris Corporation  Low Level Sequence as an AntiTamper MEchanism 
US20080294956A1 (en) *  20070522  20081127  Harris Corporation  Encryption Via Induced Unweighted Errors 
US20080294710A1 (en) *  20070522  20081127  Harris Corporation  Extending a Repetition Period of a Random Sequence 
US20080307022A1 (en) *  20070607  20081211  Harris Corporation  Mixed Radix Conversion with a Priori Defined Statistical Artifacts 
US20080307024A1 (en) *  20070607  20081211  Harris Corporation  Mixed Radix Number Generator with Chosen Statistical Artifacts 
US20080304666A1 (en) *  20070607  20081211  Harris Corporation  Spread Spectrum Communications System and Method Utilizing Chaotic Sequence 
US20090034717A1 (en) *  20070803  20090205  Oberthur Technologies  Method of processing data protected against attacks by generating errors and associated device 
US20090034727A1 (en) *  20070801  20090205  Harris Corporation  Chaotic Spread Spectrum Communications System Receiver 
US20090044080A1 (en) *  20070531  20090212  Harris Corporation  Closed Galois Field Combination 
WO2009023550A1 (en) *  20070814  20090219  Yeda Research & Development Co. Ltd.  A method and apparatus for implementing a novel oneway hash function on highly constrained devices such as rfid tags 
US20090046853A1 (en) *  20070725  20090219  Sai Chuen Hui  Method and system for generating a pair of public key and secret key 
US20090060175A1 (en) *  20070829  20090305  Schneider James P  Embedding a secret in a bit string for safeguarding the secret 
US20090110197A1 (en) *  20071030  20090430  Harris Corporation  Cryptographic system configured for extending a repetition period of a random sequence 
US20090196420A1 (en) *  20080205  20090806  Harris Corporation  Cryptographic system incorporating a digitally generated chaotic numerical sequence 
US20090202067A1 (en) *  20080207  20090813  Harris Corporation  Cryptographic system configured to perform a mixed radix conversion with a priori defined statistical artifacts 
US20090245327A1 (en) *  20080326  20091001  Harris Corporation  Selective noise cancellation of a spread spectrum signal 
US20090269538A1 (en) *  20070110  20091029  BeneckeKaliko Ag  Thermoplastic film 
US20090279690A1 (en) *  20080508  20091112  Harris Corporation  Cryptographic system including a mixed radix number generator with chosen statistical artifacts 
US20090279688A1 (en) *  20080506  20091112  Harris Corporation  Closed galois field cryptographic system 
US20090296860A1 (en) *  20080602  20091203  Harris Corporation  Adaptive correlation 
US20090310650A1 (en) *  20080612  20091217  Harris Corporation  Featureless coherent chaotic amplitude modulation 
US20090327387A1 (en) *  20080529  20091231  Harris Corporation  Digital generation of an accelerated or decelerated chaotic numerical sequence 
US20090323958A1 (en) *  20080529  20091231  Schneider James P  Extending a secret bit string to safeguard the secret 
US20100020965A1 (en) *  20071228  20100128  Shay Gueron  Method for speeding up the computations for characteristic 2 elliptic curve cryptographic systems 
US20100166041A1 (en) *  20081229  20100701  Harris Corporation  Communications system employing orthogonal chaotic spreading codes 
US20100165828A1 (en) *  20081229  20100701  Harris Corporation  Communications system employing chaotic spreading codes with static offsets 
US20100217978A1 (en) *  20070829  20100826  Schneider James P  Method for sharing secret information among cooperating parties 
US20100226497A1 (en) *  20090303  20100909  Harris Corporation  Communications system employing orthogonal chaotic spreading codes 
US20100310072A1 (en) *  20090608  20101209  Harris Corporation  Symbol duration dithering for secured chaotic communications 
US20100309957A1 (en) *  20090608  20101209  Harris Corporation  Continuous time chaos dithering 
US20100316090A1 (en) *  20090610  20101216  Harris Corporation  Discrete time chaos dithering 
US20110004792A1 (en) *  20090701  20110106  Harris Corporation  Bit error rate reduction in chaotic communications 
US20110002360A1 (en) *  20090701  20110106  Harris Corporation  Permissionbased secure multiple access communication systems 
US20110002362A1 (en) *  20090701  20110106  Harris Corporation  symbol estimation for chaotic spread spectrum signal 
US20110002364A1 (en) *  20090701  20110106  Harris Corporation  Antijam communications having selectively variable peaktoaverage power ratio including a chaotic constant amplitude zero autocorrelation waveform 
US20110019719A1 (en) *  20090722  20110127  Harris Corporation  Adaptive link communications using adaptive chaotic spread waveform 
US7937427B2 (en)  20070419  20110503  Harris Corporation  Digital generation of a chaotic numerical sequence 
US8165065B2 (en)  20081009  20120424  Harris Corporation  Adhoc network acquisition using chaotic sequence spread waveform 
US8325702B2 (en)  20080829  20121204  Harris Corporation  Multitier adhoc network in which at least two types of noninterfering waveforms are communicated during a timeslot 
US8340295B2 (en)  20090701  20121225  Harris Corporation  Highspeed cryptographic system using chaotic sequences 
US8345725B2 (en)  20100311  20130101  Harris Corporation  Hidden Markov Model detection for spread spectrum waveforms 
US8363700B2 (en)  20090701  20130129  Harris Corporation  Rake receiver for spread spectrum chaotic communications systems 
US8428104B2 (en)  20090701  20130423  Harris Corporation  Permissionbased multiple access communications systems 
US20130283345A1 (en) *  20110928  20131024  Uri Kahana  Techniques for dynamic enpoint secure location awareness 
US20140195200A1 (en) *  20110818  20140710  University Of Antwerp  Smart Data Sampling and Data Reconstruction 
US8848909B2 (en)  20090722  20140930  Harris Corporation  Permissionbased TDMA chaotic communication systems 
US20150071441A1 (en) *  20120316  20150312  Giesecke & Devrient Gmbh  Methods and system for secure communication between an rfid tag and a reader 
US20150237020A1 (en) *  20140219  20150820  Raytheon Bbn Technologies Corp.  System and method for operating on streaming encrypted data 
US20160012255A1 (en) *  20130227  20160114  Morpho  Method for encoding data on a chip card by means of constantweight codes 
US20170012775A1 (en) *  20141017  20170112  Philip J. Lafer  Encryption Methods and Apparatus 
US9886597B2 (en) *  20130227  20180206  Morpho  Method for encoding data on a chip card by means of constantweight codes 
Families Citing this family (1)
Publication number  Priority date  Publication date  Assignee  Title 

US7308097B2 (en) *  20011207  20071211  Ntru Cryptosystems, Inc.  Digital signature and authentication method and apparatus 
Citations (15)
Publication number  Priority date  Publication date  Assignee  Title 

US4799149A (en) *  19830330  19890117  Siemens Aktiengesellschaft  Hybrid associative memory composed of a nonassociative basic storage and an associative surface, as well as method for searching and sorting data stored in such a hybrid associative memory 
US5542061A (en) *  19930121  19960730  Nec Corporaiton  Arrangement of controlling issue timing of a read instruction to a common block in a vector processor 
US5699537A (en) *  19951222  19971216  Intel Corporation  Processor microarchitecture for efficient dynamic scheduling and execution of chains of dependent instructions 
US5724279A (en) *  19950825  19980303  Microsoft Corporation  Computerimplemented method and computer for performing modular reduction 
US5764554A (en) *  19941108  19980609  Sgs Thomson Microelectronics  Method for the implementation of modular reduction according to the Montgomery method 
US5983299A (en) *  19961018  19991109  Samsung Electronics Co., Ltd.  Priority request and bypass bus 
US5987574A (en) *  19970430  19991116  Sony Corporation  Bank arbitration for SDRAM memory control 
US6088453A (en) *  19970127  20000711  Kabushiki Kaisha Toshiba  Scheme for computing Montgomery division and Montgomery inverse realizing fast implementation 
US6134244A (en) *  19970830  20001017  Van Renesse; Robert  Method and system for optimizing layered communication protocols 
US6141705A (en) *  19980612  20001031  Microsoft Corporation  System for querying a peripheral device to determine its processing capabilities and then offloading specific processing tasks from a host to the peripheral device when needed 
US6151393A (en) *  19971118  20001121  Samsung Electronics Co., Ltd.  Device and method for modular multiplication 
US6157955A (en) *  19980615  20001205  Intel Corporation  Packet processing system including a policy engine having a classification unit 
US6266771B1 (en) *  19970210  20010724  The Regents Of The University Of California  Probabilistic signature scheme 
US6337909B1 (en) *  19961010  20020108  Certicom Corp.  Generation of session keys for El Gamallike protocols from low hamming weight integers 
US6341299B1 (en) *  19980226  20020122  Stmicroelectronics S.A.  Modular arithmetic coprocessor enabling the performance of nonmodular operations at high speed 
Family Cites Families (2)
Publication number  Priority date  Publication date  Assignee  Title 

CA2348700C (en) *  20000526  20080311  Andrew W. Hunt  Highperformance errorcorrecting codes with skew mapping 
CA2420359A1 (en) *  20000829  20020307  Ntru Cryptosystems, Inc.  Speed enhanced cryptographic method and apparatus 
Patent Citations (15)
Publication number  Priority date  Publication date  Assignee  Title 

US4799149A (en) *  19830330  19890117  Siemens Aktiengesellschaft  Hybrid associative memory composed of a nonassociative basic storage and an associative surface, as well as method for searching and sorting data stored in such a hybrid associative memory 
US5542061A (en) *  19930121  19960730  Nec Corporaiton  Arrangement of controlling issue timing of a read instruction to a common block in a vector processor 
US5764554A (en) *  19941108  19980609  Sgs Thomson Microelectronics  Method for the implementation of modular reduction according to the Montgomery method 
US5724279A (en) *  19950825  19980303  Microsoft Corporation  Computerimplemented method and computer for performing modular reduction 
US5699537A (en) *  19951222  19971216  Intel Corporation  Processor microarchitecture for efficient dynamic scheduling and execution of chains of dependent instructions 
US6337909B1 (en) *  19961010  20020108  Certicom Corp.  Generation of session keys for El Gamallike protocols from low hamming weight integers 
US5983299A (en) *  19961018  19991109  Samsung Electronics Co., Ltd.  Priority request and bypass bus 
US6088453A (en) *  19970127  20000711  Kabushiki Kaisha Toshiba  Scheme for computing Montgomery division and Montgomery inverse realizing fast implementation 
US6266771B1 (en) *  19970210  20010724  The Regents Of The University Of California  Probabilistic signature scheme 
US5987574A (en) *  19970430  19991116  Sony Corporation  Bank arbitration for SDRAM memory control 
US6134244A (en) *  19970830  20001017  Van Renesse; Robert  Method and system for optimizing layered communication protocols 
US6151393A (en) *  19971118  20001121  Samsung Electronics Co., Ltd.  Device and method for modular multiplication 
US6341299B1 (en) *  19980226  20020122  Stmicroelectronics S.A.  Modular arithmetic coprocessor enabling the performance of nonmodular operations at high speed 
US6141705A (en) *  19980612  20001031  Microsoft Corporation  System for querying a peripheral device to determine its processing capabilities and then offloading specific processing tasks from a host to the peripheral device when needed 
US6157955A (en) *  19980615  20001205  Intel Corporation  Packet processing system including a policy engine having a classification unit 
Cited By (91)
Publication number  Priority date  Publication date  Assignee  Title 

US20090269538A1 (en) *  20070110  20091029  BeneckeKaliko Ag  Thermoplastic film 
US20080198832A1 (en) *  20070215  20080821  Harris Corporation  Low Level Sequence as an AntiTamper MEchanism 
US8312551B2 (en)  20070215  20121113  Harris Corporation  Low level sequence as an antitamper Mechanism 
US7937427B2 (en)  20070419  20110503  Harris Corporation  Digital generation of a chaotic numerical sequence 
US20080294956A1 (en) *  20070522  20081127  Harris Corporation  Encryption Via Induced Unweighted Errors 
US20080294710A1 (en) *  20070522  20081127  Harris Corporation  Extending a Repetition Period of a Random Sequence 
US8611530B2 (en)  20070522  20131217  Harris Corporation  Encryption via induced unweighted errors 
US7921145B2 (en)  20070522  20110405  Harris Corporation  Extending a repetition period of a random sequence 
US20090044080A1 (en) *  20070531  20090212  Harris Corporation  Closed Galois Field Combination 
US7995757B2 (en)  20070531  20110809  Harris Corporation  Closed galois field combination 
US20080307024A1 (en) *  20070607  20081211  Harris Corporation  Mixed Radix Number Generator with Chosen Statistical Artifacts 
US7962540B2 (en)  20070607  20110614  Harris Corporation  Mixed radix number generator with chosen statistical artifacts 
US20080307022A1 (en) *  20070607  20081211  Harris Corporation  Mixed Radix Conversion with a Priori Defined Statistical Artifacts 
US7970809B2 (en)  20070607  20110628  Harris Corporation  Mixed radix conversion with a priori defined statistical artifacts 
US7974413B2 (en)  20070607  20110705  Harris Corporation  Spread spectrum communications system and method utilizing chaotic sequence 
US20080304666A1 (en) *  20070607  20081211  Harris Corporation  Spread Spectrum Communications System and Method Utilizing Chaotic Sequence 
US20090046853A1 (en) *  20070725  20090219  Sai Chuen Hui  Method and system for generating a pair of public key and secret key 
US8005221B2 (en)  20070801  20110823  Harris Corporation  Chaotic spread spectrum communications system receiver 
US20090034727A1 (en) *  20070801  20090205  Harris Corporation  Chaotic Spread Spectrum Communications System Receiver 
US8311212B2 (en) *  20070803  20121113  Oberthur Technologies  Method of processing data protected against attacks by generating errors and associated device 
US20090034717A1 (en) *  20070803  20090205  Oberthur Technologies  Method of processing data protected against attacks by generating errors and associated device 
US8291221B2 (en)  20070814  20121016  Yeda Research & Development Co. Ltd.  Method and apparatus for implementing a novel oneway hash function on highly constrained devices such as RFID tags 
WO2009023550A1 (en) *  20070814  20090219  Yeda Research & Development Co. Ltd.  A method and apparatus for implementing a novel oneway hash function on highly constrained devices such as rfid tags 
US8068606B2 (en) *  20070829  20111129  Red Hat, Inc.  Embedding a secret in a bit string for safeguarding the secret 
US20090060175A1 (en) *  20070829  20090305  Schneider James P  Embedding a secret in a bit string for safeguarding the secret 
US20100217978A1 (en) *  20070829  20100826  Schneider James P  Method for sharing secret information among cooperating parties 
US8243933B2 (en) *  20070829  20120814  Red Hat, Inc.  Method for sharing secret information among cooperating parties 
US20090110197A1 (en) *  20071030  20090430  Harris Corporation  Cryptographic system configured for extending a repetition period of a random sequence 
US7995749B2 (en) *  20071030  20110809  Harris Corporation  Cryptographic system configured for extending a repetition period of a random sequence 
JP2009110002A (en) *  20071030  20090521  Harris Corp  Cryptographic system configured for extending repetition period of random sequence 
US20100020965A1 (en) *  20071228  20100128  Shay Gueron  Method for speeding up the computations for characteristic 2 elliptic curve cryptographic systems 
US8144864B2 (en) *  20071228  20120327  Intel Corporation  Method for speeding up the computations for characteristic 2 elliptic curve cryptographic systems 
US20090196420A1 (en) *  20080205  20090806  Harris Corporation  Cryptographic system incorporating a digitally generated chaotic numerical sequence 
US8180055B2 (en)  20080205  20120515  Harris Corporation  Cryptographic system incorporating a digitally generated chaotic numerical sequence 
US20090202067A1 (en) *  20080207  20090813  Harris Corporation  Cryptographic system configured to perform a mixed radix conversion with a priori defined statistical artifacts 
US8363830B2 (en)  20080207  20130129  Harris Corporation  Cryptographic system configured to perform a mixed radix conversion with a priori defined statistical artifacts 
US20090245327A1 (en) *  20080326  20091001  Harris Corporation  Selective noise cancellation of a spread spectrum signal 
US8040937B2 (en)  20080326  20111018  Harris Corporation  Selective noise cancellation of a spread spectrum signal 
US8139764B2 (en)  20080506  20120320  Harris Corporation  Closed galois field cryptographic system 
US20090279688A1 (en) *  20080506  20091112  Harris Corporation  Closed galois field cryptographic system 
US20090279690A1 (en) *  20080508  20091112  Harris Corporation  Cryptographic system including a mixed radix number generator with chosen statistical artifacts 
US8320557B2 (en)  20080508  20121127  Harris Corporation  Cryptographic system including a mixed radix number generator with chosen statistical artifacts 
US20090327387A1 (en) *  20080529  20091231  Harris Corporation  Digital generation of an accelerated or decelerated chaotic numerical sequence 
US20090323958A1 (en) *  20080529  20091231  Schneider James P  Extending a secret bit string to safeguard the secret 
US8145692B2 (en)  20080529  20120327  Harris Corporation  Digital generation of an accelerated or decelerated chaotic numerical sequence 
US8615084B2 (en)  20080529  20131224  Red Hat, Inc.  Extending a secret bit string to safeguard the secret 
US8064552B2 (en)  20080602  20111122  Harris Corporation  Adaptive correlation 
US20090296860A1 (en) *  20080602  20091203  Harris Corporation  Adaptive correlation 
US8068571B2 (en)  20080612  20111129  Harris Corporation  Featureless coherent chaotic amplitude modulation 
US20090310650A1 (en) *  20080612  20091217  Harris Corporation  Featureless coherent chaotic amplitude modulation 
US8325702B2 (en)  20080829  20121204  Harris Corporation  Multitier adhoc network in which at least two types of noninterfering waveforms are communicated during a timeslot 
US8165065B2 (en)  20081009  20120424  Harris Corporation  Adhoc network acquisition using chaotic sequence spread waveform 
US8406276B2 (en)  20081229  20130326  Harris Corporation  Communications system employing orthogonal chaotic spreading codes 
US20100166041A1 (en) *  20081229  20100701  Harris Corporation  Communications system employing orthogonal chaotic spreading codes 
US20100165828A1 (en) *  20081229  20100701  Harris Corporation  Communications system employing chaotic spreading codes with static offsets 
US8351484B2 (en)  20081229  20130108  Harris Corporation  Communications system employing chaotic spreading codes with static offsets 
US20100226497A1 (en) *  20090303  20100909  Harris Corporation  Communications system employing orthogonal chaotic spreading codes 
US8457077B2 (en)  20090303  20130604  Harris Corporation  Communications system employing orthogonal chaotic spreading codes 
US8428102B2 (en)  20090608  20130423  Harris Corporation  Continuous time chaos dithering 
US8509284B2 (en)  20090608  20130813  Harris Corporation  Symbol duration dithering for secured chaotic communications 
US20100309957A1 (en) *  20090608  20101209  Harris Corporation  Continuous time chaos dithering 
US20100310072A1 (en) *  20090608  20101209  Harris Corporation  Symbol duration dithering for secured chaotic communications 
US20100316090A1 (en) *  20090610  20101216  Harris Corporation  Discrete time chaos dithering 
US8428103B2 (en)  20090610  20130423  Harris Corporation  Discrete time chaos dithering 
US8363700B2 (en)  20090701  20130129  Harris Corporation  Rake receiver for spread spectrum chaotic communications systems 
US8340295B2 (en)  20090701  20121225  Harris Corporation  Highspeed cryptographic system using chaotic sequences 
US20110002364A1 (en) *  20090701  20110106  Harris Corporation  Antijam communications having selectively variable peaktoaverage power ratio including a chaotic constant amplitude zero autocorrelation waveform 
US8369376B2 (en)  20090701  20130205  Harris Corporation  Bit error rate reduction in chaotic communications 
US20110002360A1 (en) *  20090701  20110106  Harris Corporation  Permissionbased secure multiple access communication systems 
US8406352B2 (en)  20090701  20130326  Harris Corporation  Symbol estimation for chaotic spread spectrum signal 
US20110002362A1 (en) *  20090701  20110106  Harris Corporation  symbol estimation for chaotic spread spectrum signal 
US8428104B2 (en)  20090701  20130423  Harris Corporation  Permissionbased multiple access communications systems 
US20110004792A1 (en) *  20090701  20110106  Harris Corporation  Bit error rate reduction in chaotic communications 
US8379689B2 (en)  20090701  20130219  Harris Corporation  Antijam communications having selectively variable peaktoaverage power ratio including a chaotic constant amplitude zero autocorrelation waveform 
US8385385B2 (en)  20090701  20130226  Harris Corporation  Permissionbased secure multiple access communication systems 
US20110019719A1 (en) *  20090722  20110127  Harris Corporation  Adaptive link communications using adaptive chaotic spread waveform 
US8369377B2 (en)  20090722  20130205  Harris Corporation  Adaptive link communications using adaptive chaotic spread waveform 
US8848909B2 (en)  20090722  20140930  Harris Corporation  Permissionbased TDMA chaotic communication systems 
US8345725B2 (en)  20100311  20130101  Harris Corporation  Hidden Markov Model detection for spread spectrum waveforms 
US9690749B2 (en) *  20110818  20170627  University Of Antwerp  Smart data sampling and data reconstruction 
US20140195200A1 (en) *  20110818  20140710  University Of Antwerp  Smart Data Sampling and Data Reconstruction 
US9825968B2 (en) *  20110928  20171121  Intel Corporation  Techniques for dynamic enpoint secure location awareness 
US20130283345A1 (en) *  20110928  20131024  Uri Kahana  Techniques for dynamic enpoint secure location awareness 
US20150071441A1 (en) *  20120316  20150312  Giesecke & Devrient Gmbh  Methods and system for secure communication between an rfid tag and a reader 
US9490970B2 (en) *  20120316  20161108  Giesecke & Devrient Gmbh  Methods and system for secure communication between an RFID tag and a reader 
US9277406B2 (en) *  20120316  20160301  Giesecke & Devrient Gmbh  Methods and system for secure communication between an RFID tag and a reader 
US9886597B2 (en) *  20130227  20180206  Morpho  Method for encoding data on a chip card by means of constantweight codes 
US20160012255A1 (en) *  20130227  20160114  Morpho  Method for encoding data on a chip card by means of constantweight codes 
US9338144B2 (en) *  20140219  20160510  Raytheon Bbn Technologies Corp.  System and method for operating on streaming encrypted data 
US20150237020A1 (en) *  20140219  20150820  Raytheon Bbn Technologies Corp.  System and method for operating on streaming encrypted data 
US20170012775A1 (en) *  20141017  20170112  Philip J. Lafer  Encryption Methods and Apparatus 
Also Published As
Publication number  Publication date  Type 

WO2002089399A1 (en)  20021107  application 
US20070206784A1 (en)  20070906  application 
US7853014B2 (en)  20101214  grant 
WO2002089399B1 (en)  20021227  application 
US7218734B2 (en)  20070515  grant 
Similar Documents
Publication  Publication Date  Title 

Gupta et al.  Performance analysis of elliptic curve cryptography for SSL  
Johnson et al.  The elliptic curve digital signature algorithm (ECDSA)  
Lenstra et al.  The XTR public key system  
US5848159A (en)  Public key cryptographic apparatus and method  
US5442707A (en)  Method for generating and verifying electronic signatures and privacy communication using elliptic curves  
Huang et al.  A new cryptographic key assignment scheme with timeconstraint access control in a hierarchy  
Lauter  The advantages of elliptic curve cryptography for wireless security  
US5497423A (en)  Method of implementing elliptic curve cryptosystems in digital signatures or verification and privacy communication  
Alkim et al.  Postquantum key exchangea new hope.  
Koblitz et al.  The state of elliptic curve cryptography  
Zheng et al.  How to construct efficient signcryption schemes on elliptic curves  
US20030123655A1 (en)  Method and apparatus for elliptic curve scalar multiplication  
US6307935B1 (en)  Method and apparatus for fast elliptic encryption with direct embedding  
US5805703A (en)  Method and apparatus for digital signature authentication  
Harn  Publickey cryptosystem design based on factoring and discrete logarithms  
US20070156586A1 (en)  System and method for comparison of private values  
US6411715B1 (en)  Methods and apparatus for verifying the cryptographic security of a selected private and public key pair without knowing the private key  
US20020057796A1 (en)  Method for accelerating cryptographic operations on elliptic curves  
Mambo et al.  Proxy cryptosystems: Delegation of the power to decrypt ciphertexts  
US6480605B1 (en)  Encryption and decryption devices for publickey cryptosystems and recording medium with their processing programs recorded thereon  
Boneh  Twenty years of attacks on the RSA cryptosystem  
US6252959B1 (en)  Method and system for point multiplication in elliptic curve cryptosystem  
US7127063B2 (en)  Method and apparatus for computing a shared secret key  
Kapoor et al.  Elliptic curve cryptography  
US7233970B2 (en)  Computational method, system, and apparatus 
Legal Events
Date  Code  Title  Description 

AS  Assignment 
Owner name: LAYER N. NETWORKS, INC., TEXAS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BLAKLEY, GEORGE ROBERT;DATTA, RAJAT;MITCHELL, OSCAR R.;AND OTHERS;REEL/FRAME:012898/0052;SIGNING DATES FROM 20020423 TO 20020426 

AS  Assignment 
Owner name: SILICON VALLEY BANK, CALIFORNIA Free format text: SECURITY INTEREST;ASSIGNOR:LAYER N NETWORKS, INC.;REEL/FRAME:014052/0966 Effective date: 20030424 

AS  Assignment 
Owner name: BRITESTREAM NETWORKS, INC., TEXAS Free format text: CHANGE OF NAME;ASSIGNOR:LAYER N NETWORKS, INC.;REEL/FRAME:015341/0922 Effective date: 20040915 

AS  Assignment 
Owner name: LAYER N NETWORKS, INC., TEXAS Free format text: RELEASE;ASSIGNOR:SILICON VALLEY BANK;REEL/FRAME:018654/0172 Effective date: 20061127 

AS  Assignment 
Owner name: NCIPHER CORPORATION LIMITED ACTING BY AND THROUGH Free format text: ASSET PURCHASE AGREEMENT (ATTACHED);ASSIGNOR:BRITESTREAM NETWORKS, INC.;REEL/FRAME:019365/0868 Effective date: 20061107 

CC  Certificate of correction  
CC  Certificate of correction  
FPAY  Fee payment 
Year of fee payment: 4 

AS  Assignment 
Owner name: THALES ESECURITY LTD., UNITED KINGDOM Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:NCIPHER CORPORATION LTD;REEL/FRAME:029018/0612 Effective date: 20120608 Owner name: THALES HOLDINGS UK PLC, UNITED KINGDOM Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:THALES ESECURITY LTD.;REEL/FRAME:029018/0784 Effective date: 20120608 

FPAY  Fee payment 
Year of fee payment: 8 